feat(r1): publish the exact Gate A accepted 3.3.0 product candidate - #34
Closed
ajhcs wants to merge 180 commits into
Closed
feat(r1): publish the exact Gate A accepted 3.3.0 product candidate#34ajhcs wants to merge 180 commits into
ajhcs wants to merge 180 commits into
Conversation
…tract Define ProviderDriverV1 as a pure preflight/launch/reconcile/cancel surface with typed results and exact ChildEnvelopeV1 launch proof. Capability declaration reuses the accepted P05 13-field bridge; live progress, restart reattach, cancellation, and detailed events fail closed when unsupported. Process-local transitions deny duplicate dispatch, stale identity, and post-dispatch replay. No provider transport, registry cutover, scheduler, or durable store is claimed.
Drive scripted drivers through the closed P17 lifecycle without a transport. Cover P05 13-field alignment, hostile descriptors, proxies, accessors, symbols, exotic prototypes, sparse/alias/cycle/depth graphs, and transition/correlation/duplicate/stale/tamper cases. Unsupported features and capability-contradicting launch certainty fail typed.
Document the closed envelope/capability contract, P05 13-field alignment, honest feature failures, and that P18/P20/P19/P21 still own concrete transports. Future work keeps the run runtime, candidate composition, and AttentionBatchV1 unimplemented.
Answer exactly one question deterministically and fail closed: is this string a strict portable run-relative artifact path? Accept only NFC, well-formed, forward-slash, relative paths of 1..16 segments (128 UTF-8 bytes each, 1024 total). Reject backslashes, leading/trailing/doubled slashes, empty and dot-only segments, colons (foreclosing drive, UNC, alternate-data-stream, and scheme spellings under one rule), Windows reserved device stems with the extension ignored, edge dots/spaces that Windows tooling strips, C0/C1 controls, invisible/format/bidi/tag code points, solidus look-alikes, non-NFC text, and lone surrogates while keeping well-formed astral characters legal. The fixed validation pipeline raises identical first typed errors from a closed 17-code vocabulary, never echoes hostile bytes (U+ notation and offset only), captures every dynamic intrinsic at import, scans strings by code points, and returns deep-frozen detached descriptors. Pure path policy only: no filesystem, network, or process I/O, and no claim that P08 artifact storage exists. Focused hostile coverage pins the rejection matrix, ordering, bounds parity, predicate agreement, and detachment.
Bind exactly ten keys: exact run/child identifiers reusing the accepted manifest grammars, artifact kind bound to the detached P17 capability vocabulary, raw-vs-sanitized class with class-dependent bounded-evidence caps (sanitized 256 KiB, raw 32 MiB), declared byte length, 64-character lowercase SHA-256, and closed media-type/content-encoding enums. The relative path carries no class marker; consumers trust the ref, never the name. Hostile inputs fail closed before any effect: live/revoked Proxies with zero traps, accessor properties whose getters never run, symbol keys, exotic prototypes, own undefined, sparse/extended arrays, aliases and cycles, depth and size. Parsed results are deep-frozen detached snapshots built property-by-property, so later caller mutation cannot drift a digest or a comparison. Digests follow the accepted P03 framing conventions without touching its closed registry: SHA-256 over validator-owned canonical JSON behind an explicit domain string, big-endian version, ratified private label, and length-prefixed parts, so key order cannot change a digest while any value change must. Ordering is deterministic via one total tuple comparator plus a bounded (64) duplicate-free batch orderer. Pure schema and path policy only: no constructor from bytes, no reader, no sanitizer, no existence check, and no claim that P08 storage exists. Focused hostile coverage pins proxies, accessors, coercion hooks, closure-before-vocabulary ordering, batch hostility, and mid-call mutation inertness.
Document the closed ten-key ArtifactRefV1 schema, the strict portable relative artifact path policy with its fixed denial pipeline, the domain-framed canonical digest authority, deterministic ordering, and the pure schema/path-policy boundary that claims no P08 storage.
…ission Persist P06-bound canonical run records in a caller-supplied existing private directory. Fail closed on symlink, non-directory, and unsafe ownership or mode surfaces, use no-follow opens, and publish through same-directory temps, fsync, and exclusive link without overwriting an authoritative record. Exact same key plus canonical body returns the existing record; conflicting keys or bodies and mismatched protected identity fail closed.
Add focused and adversarial coverage for idempotent replay, identity and idempotency conflicts, concurrent duplicate submissions, process restart restore, symlink and hardlink refusal, path traversal, malformed truncated oversized and foreign files, torn temps, proxy accessor alias and cycle inputs, and bounded directory floods.
Document the library-only identity-bound run store, its private-root and no-follow constraints, and the explicit non-goals that remain for later slices.
Bind validated ArtifactRefV1 declarations to real bytes under one caller-supplied existing private store root. Map each strict P07 relative path segment-for-segment into disjoint raw/ and sanitized/ namespaces with a strictly parsed canonical sidecar per artifact; no parallel ref or path schema is introduced and traversal, device-name, separator-look-alike, and Unicode hostility inherit the exact accepted P07 denials. Sources are intrinsic Buffer/Uint8Array views or bounded async iterables of such views, denied before any byte is read when proxied, subclassed, SharedArrayBuffer-backed, accessor-dressed, or string-typed. Declared byte_length and sha256 stay untrusted claims: bytes stream into an unpredictable owner-only same-directory temporary with the class cap enforced per chunk before it is written, actual length and digest are computed from streamed bytes, and exact agreement is required before the fsynced temporary is published by exclusive hardlink that refuses to clobber. Root and parent chains use O_NOFOLLOW descriptor discipline, lstat-walked 0700 components, and post-publication identity re-proof. Conflicts, metadata mismatches, and competing publications fail closed with typed content-free errors while identical resubmission stays idempotent.
Twenty-eight focused tests cover the publication contract end to end: frozen detached content-free receipts, buffer/stream equivalence, idempotent replay versus content and metadata conflicts, disjoint raw/sanitized namespaces, untrusted declared claims, class-cap enforcement before over-allocation, bounded ordered batch verification, deterministic concurrent identical and conflicting submissions, and restart-stable inventory fingerprints. The adversarial battery inherits P07 ref hostility (proxies with zero traps, accessors that never run, alias cycles, traversal, device names, separator look-alikes, NFC violations) and adds store-specific attacks: symlinked parents, targets, and sidecars that are never followed; exfil hardlinks; writer-less FIFOs opened without blocking; wholesale root swaps and mid-publication parent swaps interleaved through a hostile chunk source; crash debris including leftover temporaries, orphaned content, and orphaned sidecars; truncated, oversized, same-size-swapped, and malformed stored state; directory floods and depth overruns against bounded enumeration; and a content-freeness sweep proving no denial ever echoes the root, artifact bytes, or an errno.
Document the private-root namespace layout, the untrusted-claim streaming publication with exclusive-link atomicity, idempotency and typed conflict semantics, descriptor/no-follow root and parent discipline, bounded streaming verification and audit with a restart-stable inventory fingerprint, and the explicit non-goals that remain for later slices.
Deny the private temporary-name grammar on every artifact path segment and its sidecar form before publication, not only the leaf, so a reserved parent cannot publish and later self-condemn as crash debris. Verification retains the stored sidecar snapshot, fails mismatches with the same content/metadata split as publish, and measures bytes against the sidecar digest and length rather than the caller view.
…tract Add a narrow serialized P08 store hook that no-follow opens a regular single-link sanitized artifact, re-validates sidecar, ref, identity, size, and digest, hashes the whole file in fixed chunks while retaining only the requested bounded range, and proves before/after stability. The model-facing reader accepts only an exact sanitized ArtifactRefV1, rejects raw before I/O, validates intrinsic integer offset/range options against the fixed range cap, and returns frozen detached JSON-safe metadata plus bounded base64 selected content.
Reader pages record whether the range or wire cap shortened the selected window, and they expose more/next_offset for deterministic paging through the sanitized artifact. Source size, redaction count, sanitizer version, completeness, and upstream truncation stay null until P09 provenance exists — never false and never invented as zero. The serialized page is forced under a fixed wire cap. Optional docs/r1-artifact-reader.md states the contract without claiming later slices.
Add a fixed-version P09 sanitizer/writer that accepts only intrinsic byte views or a bounded async iterable of those views, incrementally UTF-8-decodes identity-encoded text, applies one built-in bounded redaction policy, and publishes raw plus sanitized artifacts through the accepted P08 public store APIs. Caps, declared digest/length, and class separation fail closed without clipping or reading stored raw bytes; provenance is frozen and content-free.
Focused pages cover frozen JSON-safe output, deterministic range paging, cap/EOF boundaries, raw denial before I/O, disjoint raw/sanitized siblings, wire-cap clipping versus unknown P09 provenance, Unicode and binary encodings, and the absence of sanitizer/server imports. The adversarial battery reuses P08-published sanitized fixtures and inherits P07 ref hostility (proxies with zero traps, accessors that never run, traversal and device names) plus option proxies. It proves chunked hashing never requests a whole-file buffer, same-size tampers and sidecar/ref conflicts fail closed, symlinks/hardlinks/FIFOs are not followed, torn debris and root swaps stay rejected, mid-read mutation cannot pass digest or path-identity checks, and every denial stays content-free.
Hold a finite decoded overlap so credential, bearer, env, URL, and prompt matches that straddle ingest chunks redact identically to the unsplit source. Streaming UTF-8 decode preserves astral sequences across every byte split, and malformed or unpaired input becomes U+FFFD deterministically without clipping a truncated multi-byte sequence.
Pin every byte-split of credential, bearer, env, URL, prompt, and astral/malformed/unpaired UTF-8 streams to the unsplit digest and counts. Fail closed on over-cap, endless, huge, short, and over- declared sources without publishing, and deny Proxy, revoked Proxy, subclass, SharedArrayBuffer, accessor, arbitrary, and invalid chunk sources with content-free errors.
Additive run-reducer.mjs owns the closed P25 run-journal event vocabulary, the per-child and per-run transition lattice, and the monotonic terminal-absorbing derived-state projection. Identical inputs always reduce to the identical frozen state, so exact crash/restart replay reproduces the exact derived state. Dense sequences, domain hash-chain linkage, closed event/artifact-ref shapes, the 1-8 child bound with unknown-child refusal, absorbing child and run terminals, and counter-sum invariants are enforced with typed constant errors. No I/O, clock, randomness, artifact verification, scheduler/provider invocation, or attention reduction.
Additive run-journal.mjs binds every create/open/append/read to an exact validated accepted-P24 durable run record (openRunStore handle plus the getByRunId result) by run identity and canonical digest before any journal path is created or read, and operates only inside one per-run private directory under a separate caller-supplied existing private journal root; sharing the P24 store root fails closed. A creation stamp bound to that record survives inode reuse, every operation re-verifies the bounded runs/ namespace, and all operations take the advisory lock, so deleted-and- recreated directories, foreign substitutions, and cross-process atomic replacement races fail or retry within bounds instead of ever observing a torn view. Entries are bounded canonical JSONL with dense sequences and a domain-separated SHA-256 hash chain over closed event and artifact-ref shapes. Appends serialize through an exclusive lock file with bounded dead-owner and age-capped stale recovery, a protected .lock- owner namespace that cleanup never touches, compare-and-swap expected_seq, exact head dedupe derived from the audited entry stream, typed replay and dedupe conflicts, and full lattice validation before any byte is written; publication is crash-safe (same-directory private temporary, complete write, file fsync, atomic rename, directory fsync) and verified byte-exact against the audited prefix plus one entry, then the derived state cache is published the same way, so crashes leave only unpublished temporaries or a stale cache. A torn unterminated final line is the only healable damage; any committed corruption or regression, malformed or foreign entry, symlink, hardlink, swap, or flood fails hard with typed constant errors. Cursors are opaque run-bound checksummed tokens rejecting tampering, staleness, and cross-run reuse; pages and diagnostics are bounded and content-free.
…ehavior r1-run-journal covers exact P24 record binding before any path exists, one/two/eight-child lifecycles with absorbing terminals and the ninth-child bound, exact head dedupe against typed replay and dedupe conflicts, compare-and-swap expected_seq, crash/restart exact replay with stale-cache republish, torn-tail healing on demand and before the next append, committed-corruption hard failures, bounded run-bound cursor paging with content-free diagnostics, cross-process serialization through spawned workers, duplicate-submission single-winner semantics, dead-owner lock recovery and live-owner timeout, entry caps, private modes, and hardlink refusal. r1-run-journal-adversarial drives a seeded hostile randomized transition lattice against an independent reference oracle across many runs, rejects hostile event payloads, symlinked journal/state/lock/stamp/temp names with per-surface typed codes including the advisory lock's own corrupt code, run-directory and whole-root swaps including inode-reuse attempts via the creation stamp, directory floods, foreign entries, oversized files, non-canonical or hash-breaking committed lines, foreign lock files, cursor tampering/staleness/cross-run reuse, append-shape violations without writes, forged P24 bindings with zero filesystem side effects, and frozen content-free outputs. A 3-worker stress fixture anchors cross-process serialization; repeated suite runs stay green.
Record the append-only run journal, deterministic terminal-absorbing reducer, and run-bound cursor in the unreleased changelog, and update the R1 future-work status to reflect P24+P25 library persistence while the scheduler, provider dispatch, workspace provisioning, cleanup, candidate composition, attention batch, and MCP wiring remain future work.
Bind provider slot grok onto the accepted P17 preflight/launch/reconcile/cancel contract and the P05 13-field capability record. An injected bounded ACP transport confirms launch only after acknowledgement; post-spawn loss is dispatch_uncertain and is never replayed.
Prove pre-spawn failure versus post-spawn uncertainty, acknowledgement, duplicate launch, attention/reply identity, cancellation races, restart reattach, event/cursor bounds, malformed and forged receipts, and hostile direct-JS inputs without a live Grok client.
State that the adapter is not live-transport qualification and does not cut the supervisor over or claim durable P19/P21 state.
Combine the accepted possible-send replay repair with the accepted terminal latch, idempotent terminal cancellation, and closed blocked-preflight diagnostics. Preserve legitimate not-sent retry while denying replay after any possible send.
Inspect own property descriptors on Buffer/Uint8Array sources and stream chunks before reading buffer, byteOffset, byteLength, or subarray. Reject own accessors and data overrides without executing getters, and keep ordinary intrinsic views and their digests unchanged.
# Conflicts: # CHANGELOG.md
Pin the hostile CLI close-timeout regression against ambient WORKTREE_BOOTSTRAP_TASK and related WTB keys by injecting runFileImpl and explicit env shapes so real worktree-bootstrap verify cannot execute.
Projection may keep or downgrade truncation/completeness and represents missing redaction, version, and completeness as unknown. Capture re-hashes stored bytes and fails closed on mismatch, substitution, partial reads, or stale artifacts.
Close B1: inspect/remember recover authoritative P24 submission identity after restart and leave incomplete identity unknown. Byte-identical resubmits stay created=false across inspect-first, status-first, remember-first, and submit-first order with one provider dispatch. Genuine identity conflicts remain runtime_identity_conflict without weakening P24 arbitration.
…date Apply binary-safe writer deltas in manifest order onto the immutable run base, revalidate path ownership and P28/P30 Git policy, and create only the one-parent non-authoritative candidate ref. Conflicts are never repaired; required missing, rejected, or unresolved writers block ready.
Consume composition receipts as values and verify the run-owned candidate through P13/P14/P15/P16/P30/P32. Incomplete diagnostic output never becomes ready_for_codex_review; Codex remains the only acceptance authority.
Cover proxy and accessor fail-closed paths, conflict non-repair, spawn command allowlisting, and refusal to upgrade incomplete or blocked candidates to ready_for_codex_review.
…osition Record the P35 composer and combined-verifier contract: binary-safe manifest order, one-parent candidate ref, no conflict repair, and Codex as the sole final acceptance authority.
Close Luna p35-b1. Combined verification binds composition.candidate_ref to accepted P28 run-owned candidate-ref authority and the same run/receipt identity instead of a permissive string check. Unauthorized refs return frozen failed evidence and never verified or ready.
…ad-r1-w27-p35-composition-20260826
Map submit/status/wait/attention/reply/cancel/cleanup onto the frozen status, delegate, task, tasks, and cancel catalog. Omitted additive fields keep exact 3.2.1 behavior; validation fails before dispatch, ref creation, or cleanup. Provider selection stays on the four-slot registry with P33/P34/P35 and R-TRUTH authority preserved.
Cover five-tool catalog stability, omitted 3.2.1 compatibility, validation-before-side-effects, 1-8 lane aggregation, attention/reply semantics, P22 isolation, unresolved blocking, evidence redaction, lifecycle/cleanup authority, P35 ref preservation, and denied remote mutation without weakening accepted 3.2.1 tests.
Document the Sol-frozen submit/status/wait/attention/reply/cancel/cleanup mapping on the existing catalog, omitted-mode 3.2.1 compatibility, and the P33/P34/P35 plus four-slot registry authorities this cutover preserves.
…ckers Default production seams use durable P33/P34 run/journal/attention authorities so restart recovery, cursors, and cleanup are not process-local. decision_or_attention performs a bounded wait, cancel returns scheduler confirmation, replies use CAS/exactly-once rejection, profile selection fails closed, and model-facing artifacts are recursively sanitized before any resume.
… blockers Bind production P34 attention.reply to supervisor same-session delivery, keep unconfirmed cancel unresolved, persist scheduler/artifact authority before dispatch, and resolve assignments from one immutable catalog snapshot.
Consume the persisted scheduler dispatched fact instead of hard-coding dispatched=true, so a pre-dispatch crash reopens unresolved and blocked without provider replay or running/cancelled authority.
Accept child and run journal terminals only for authoritatively dispatched lanes, settle cancelled only on confirmed cancellation, and keep dispatched=false/unresolved nonterminal through resume and cancel.
…ad-r1-w28e-rcutover-two-repair-final-integration-20260826
…ad-r1-w28e-rcutover-two-repair-final-integration-20260826
…ad-r1-w28g-final-closure-integration-20260826
…tic proof Remove the two host-load 500ms release assertions from the legal-cap and range-amplification batch tests. Prove the hostile legal-cap product 96 x 4,177,920 = 401,080,320 exceeds GLOB_MATCH_STEP_BUDGET while the same single pattern/path product 96 x 4,080 = 391,680 stays valid. Pin the exact typed aggregate error, repeat-call determinism, valid single-path result, and '**' batch behavior, and prove from source order that aggregate rejection follows bounded validation and precedes match-matrix DP. Correct only the bounded-work comments so they distinguish validation caps from pre-match DP rejection. Executable matcher bytes, exports, budgets, caps, error vocabulary, and behavior are unchanged.
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes exact Gate A accepted product head 5f322b5, tree 4a6c2c8f0eeb7e30dd3cfbfe45c0da3cb2321b8d, candidate key 9a46a84f1b6783fc9501d101dea64b496b3d0532031318067ee645edb7161d78. Repository-declared Gate A passed all 14 stages first attempt; Co-Engineer 1758/1758; fresh Muse and Luna Max repair reviews ACCEPT. This head preserves every accepted slice and the documented supersession/repair chains. Superseded intermediates—including 5fb5691c, d0d180a, 3b68a49, 47ddeb9, 005c121, 7feba61, e18884c, 4ec7db3, 35bf91b, 7ad1991, dd9dfeb, 683f1a3, f30ec8c5, and ccc4f01—remain negative evidence and are not merge/tag/release/rollback authorities. Closed PR #28 head 9a37eba is unrelated and absent. Review and CI authority apply only to exact final head/tree. Regular merge only; no squash or rebase.